The latest Risk Barometer, a global report from insurer Allianz, shows that cybersecurity is the second-biggest concern for Brazilian executives, tied with other business disruption risks and behind only climate change.
According to the 68 executives surveyed in Brazil, recurring breaches and data leaks, IT service interruptions, and the greater sophistication of ransomware-type attacks are among the reasons. Cybersecurity concerns have also increased due to the greater availability of generative artificial intelligence tools, which are taking fraud and phishing tactics to a new level.
IDC, a market intelligence firm focused on the tech sector, estimates that cyberattacks will increase by 12 percent this year, even though investment in cybersecurity in Brazil has increased by more than 16 percent to around USD 1.7 billion — outpacing the 9 percent increase in investment in the IT sector as a whole.
After China, Latin America is the region where cybersecurity investments are growing the fastest, Luciano Ramos, country manager at IDC Brazil and head of software and IT services domains at IDC Latin America, tells The Brazilian Report.
By surveying more than 200 companies in Latin America, IDC found that most already have at least one AI-enabled use case, whether that be related to anti-fraud mechanisms, data and demand analytics, or automated responses for product recommendations, for example.
“We’re experiencing a technology hype due to the rise of big language models, but what we’re seeing now is that this is cooling off a bit and companies are turning back to traditional AI projects that are embedded in specific functions of each business, and which many companies took for granted, to figure out how to use new tools to improve them, or even to discover if and when it’s worth the effort,” says Mr. Ramos.
Consulting firm GlobalData singles out Brazil as the place where growth will be higher in the coming years. While the U.S. and China account for 40 percent of the market, generative AI in Brazil is expected to grow at a compound annual rate of 100 percent until 2027.
According to IDC, the management solutions market, which includes ERP and CRM systems as well as supply chain platforms, will reach USD 5.6 billion in Brazil in 2024, up 11.6 percent from the previous year. Of that amount, USD 1.6 billion will be for analytics and AI platforms, and USD 588 million will be “associated with the intelligence capabilities embedded in these solutions.”
According to Mr. Ramos, most companies do not intend to develop everything in-house, but rather to partner with the AI companies that have emerged in the last two years. However, there are concerns that come with these partnerships, such as ensuring that the information they are using to power an LLM is secure.
“It’s in this dynamic that vendors and customers will work in 2024,” he adds.
IT security, including the protection of hybrid and cloud environments, is the top issue for Latin American companies when it comes to the skills and technologies required for strategic business priorities. About 50 percent of them responded to the IDC survey.
However, there is a significant difference when looking at organizations by size: while nearly 95 percent of large companies have solutions with AI capabilities to help with IT security, only 56 percent of small and medium-sized companies have these solutions.
Among medium and large Brazilian companies interviewed for another IDC survey, 54 percent said they are studying how to apply gen-AI, and 20 percent said they are also trying to understand how best to train their employees in the new technology.
AI benefits v. AI risks
Phishing attacks, which consist of thousands of fraudulent messages with suspicious links sent randomly through social media, messaging apps, or emails with malicious files attached, make up a large portion of cyberattacks and scams targeting businesses and individuals in Brazil.
The fact that Brazilians are consistently among the earliest adopters of digital technologies — as evidenced by the massive penetration of the country’s PIX instant payment system — contributes to their vulnerability to these threats.
These malicious links often direct victims to fake versions of websites and applications and ask them to enter sensitive information, such as a bank account password, while email attachments are usually malware (destructive programs) installed on the victim’s device to steal information.
While foreign criminals target companies and use these tactics as a springboard for larger invasions, domestic hackers mainly run financial scams against individuals.
In both cases, warns Wladimir Fragoso, coordinator at FastHelp, a Brazilian IT and security services company, phishing tactics have evolved into “spear-phishing,” or targeted attacks in which specific individuals, such as high-ranking executives, have their online behavior meticulously studied, allowing the criminal to pose as a boss, colleague, or acquaintance to ask for information or action.
In the wake of PIX and other digital payment solutions, a common type of spear-phishing being increasingly used by criminals in Brazil is “quishing,” which involves combining phishing with malicious QR codes instead of links or files.
Security services and technology provider Trend Micro recently added quishing to its behavioral tools, which can “sound the alarm” when things don’t look legitimate.
These tools spend some time, usually a month or so, learning how users write and behave based on a number of criteria, such as language and punctuation, until they are able to identify what is legitimate, explains Flavio Silva, technical manager of Trend Micro in Brazil, to The Brazilian Report.
Anything out of the ordinary generates alerts and access is blocked to prevent these episodes from becoming larger attacks. Most of the firm’s clients are medium-sized companies, so the idea is to prevent high-level executives of these organizations from reading malicious QR codes — through which criminals try to steal their credentials and multi-factor authentication information.
“It’s an example of using AI for good, to help prevent attacks,” says Mr. Silva.
However, the use of AI tools for crafting deepfake images, videos, or audio for use in spear-phishing is one of the biggest risks for 2024, according to Trend Micro’s latest Security Predictions report. Voice cloning and other AI-based tactics will also be widely used in “harpoon hacking attacks,” which are even more targeted social engineering scams that involve emails that contain personal information and are crafted with a sense of urgency.
This is exactly what happened to a finance employee of a multinational company in Hong Kong in early February. He was tricked into paying USD 25 million to fraudsters who used deepfake technology to impersonate the company’s CFO in a video conference call.
In Brazil, attacks such as these targeting individuals have already been reported. Criminals made a video call to a woman pretending to be her daughter, asking her to transfer BRL 600 (about USD 120) via PIX to her daughter’s friend. The woman was suspicious of the call because her daughter had just left the house wearing clothes different from those in the video.
Also, the person on the screen had not called her by an affectionate nickname that the two of them usually call each other. Suspicious, the woman asked the name of the family dog. Not knowing the answer, the criminals ended the call. “It had my face, my hair, and my voice. The only detail is that the voice was a little out of step with the video, but we know that can happen with a [bad] internet connection. It’s scary to see the evolution of this type of scam,” the victim’s daughter recently told BBC News Brasil.
The Brazilian case scares experts because it shows that AI-driven tactics are being used against individuals as well as large corporations, prompting them to double down on warnings to small and medium-sized companies.
“As always, the weakest link is the human. So for all the companies we serve, regardless of their size, one of the focuses for 2024 is to convince them to invest in training and awareness. Sometimes the company has the tools and the team, but the team does not have the necessary skills to face the current threats,” says Mr. Fragoso.
Search
